current community

your communities

more stack exchange communities

Stack Exchange
tour help
stack overflow careers
Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote 0 down vote favorite

Please how to pass the 'inp" variable from this piece of vbs to my batch named job.bat? Indeed when doing echoing (echo %2) from job.bat, i notice that the inp is not passed properly. prompt command views inp and not the value retrieved from vbs. Thanks

For Each listElement In xmlDoc.selectNodes("document/Lists/list")
 msgbox "toto"
 inp=listElement.selectSingleNode("entry").text
 out=  listElement.selectSingleNode("output").text
 jeton=  listElement.selectSingleNode("token").text

 dim shell
 set shell=createobject("wscript.shell") 
 shell.run "job.bat ""a file"" **inp** "
 set shell=nothing 
 Next
share|improve this question

2 Answers 2

up vote 1 down vote

Unlike several other languages VBScript doesn't expand variables inside strings. Because of that, inp in the string

"job.bat ""a file"" inp "

is just the literal string "inp", not the value of the variable inp. To produce a string with the value of a variable, you have to concatenate base string and variable like @rojo suggested:

shell.run "job.bat ""a file"" " & inp

I would, however, not recommend doing this without some safety precautions. For one thing you should always put double quotes around your arguments, in case they contain spaces. I normally use a quoting function for this to prevent the instruction from becoming riddled with quad-quotes:

Function qq(str) : qq = Chr(34) & str & Chr(34) : End Function

'...
shell.run "job.bat " & qq("a file") & " " & qq(inp)

You should also always apply sanitizing to all user input that is passed to a shell command. Otherwise your users might wreak havoc by entering something like foo & del /s /q C:\*.*. Common practice is to allow only known-good characters in the input string and replace everything else with a safe character (e.g. an underscore). You can achieve this with a regular expression:

Set re = New RegExp
re.Pattern = "[^ a-z0-9äöü.,_$%()-]"
re.Global  = True
re.IgnoreCase = True

inp = re.Replace(inp, "_")
share|improve this answer
    
+1 thorough. I'm curious about something, though. You know with an ADODB.Command object you can do parameterized queries -- cmdObj.commandText = "INSERT INTO table (col1, col2) VALUES (?, ?)" and then cmdObj.parameters(0).value = "val1" and cmdObj.parameters(1).value = "val2" to prevent SQL injection attacks. Can that same convention of building a parameterized query be employed for other things, such as building a shell.run command? –  rojo Apr 2 '13 at 12:54
    
Not that I know of. You'd need some sort of escaping function to "defuse" potentially harmful characters, but I'm not aware of any such function/method built into VBScript (or the usual COM objects). –  Ansgar Wiechers Apr 2 '13 at 12:58
1  
Actually, I just ran a test, and it appears that the Shell.Application object's ShellExecute method successfully encapsulates arguments to prevent the sort of attack you're describing. Might be safer than wsh.shell's run method. –  rojo Apr 2 '13 at 13:04
    
Too late! I got impatient, so I added it to my answer. :> –  rojo Apr 2 '13 at 13:27
up vote 1 down vote

I think what you're looking for is this.

shell.run "job.bat ""argfile.ext"" " & inp

However, as Ansgar Wiechers points out, this is a potentially severe security hole, as a treacherously crafted XML file could run arbitrary commands. To encapsulate your batch file arguments and prevent unintended consequences, consider switching to the Shell.Application object's ShellExecute method.

For Each listElement In xmlDoc.selectNodes("document/Lists/list")

    msgbox "toto"
    inp = listElement.selectSingleNode("entry").text
    out = listElement.selectSingleNode("output").text
    jeton = listElement.selectSingleNode("token").text

    set shell=CreateObject("Shell.Application") 
    shell.ShellExecute "job.bat", """a file"" " & inp, "path\to\batfile\", "runas", 1
    set shell=nothing 

Next
share|improve this answer
    
Thanks. It works out! –  tamo Apr 2 '13 at 9:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.